Extracted

• • Target
    suprwskng.JS
  • Size 9.7MB
  • SHA256 5756f3de82b7971cef826adf4d4ab9dc61dba6617a89377c0721eebe655e4d5c
  • MD5 e9d4270bde3ec43e6080f0a5b529b5e3
  • SHA1 70276d044bcafccbefb771b22e3c2092c5277067
  • SHA512 f6a1b7093c711966653c44bd6e8c1807b184884bd8c001224ab1731d51ffbb61ca61b5a085b92e7e1ef02e3d153fa2dc85971108750f89b35def724f7755374b
  • SSDEEP 196608:D+HSa+kL35tryDIaR+H7CX60iVKyCDzWPmAVIqlKgwhC8/R4uBb8p10bd0qYjElD:DaROAADAr6R5nCa8lulLxkcJRdXawlmi
  • TLSH
    T134A6288F17A692333315EEC98735EC31D54E82A73585CB20B1DEED19392CD1DA258BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutiondonutloaderphantom_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2